Use scripts to bulk migrate your policies to use fine-grained IAM actions

To help migrate your IAM policies to use new actions, known as fine-grained actions, you can use scripts from the Amazon Samples website.

You run these scripts from the payer account of your organization to identify the following affected policies in your organization that use the old IAM actions:

The scripts generate suggestions for new actions that correspond to existing actions that are used in the policy. You then review the suggestions and use the scripts to add the new actions across all affected policies in your organization. You don't need to update Amazon managed policies or Amazon managed SCPs (for example, Amazon Control Tower and Amazon Organizations SCPs).

You use these scripts to:

For more information about policies and service control policies (SCPs), see the following topics:

Overview

Follow this topic to complete the following steps:

Prerequisites

To get started, you must do the following:

Step 1: Set up your environment

To get started, download the required files from the Amazon Samples website. You then run commands to set up your environment.

For more information, see the README.md file.

Step 2: Create the CloudFormation StackSet

Follow this procedure to create a CloudFormation stack set. This stack set then creates the BillingConsolePolicyMigratorRole IAM role for all member accounts in your organization.

After CloudFormation creates the stack set, each member account in your organization has an BillingConsolePolicyMigratorRole IAM role.

The IAM role contains the following permissions:

"iam:GetAccountAuthorizationDetails",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetUserPolicy",
"iam:GetGroupPolicy",
"iam:GetRolePolicy",
"iam:CreatePolicyVersion",
"iam:DeletePolicyVersion",
"iam:ListPolicyVersions",
"iam:PutUserPolicy",
"iam:PutGroupPolicy",
"iam:PutRolePolicy",
"iam:SetDefaultPolicyVersion"

Step 3: Identify the affected policies

After you create the stack set and downloaded the files, run the identify_affected_policies.py script. This script assumes the BillingConsolePolicyMigratorRole IAM role for each member account, and then identifies the affected policies.

You can use the following input parameters:

After you run the script, it creates two JSON files in a Affected_Policies_<Timestamp> folder:

Step 4: Review the suggested changes

After the script creates the affected_policies_and_suggestions.json file, review it and make any changes.

Example 1: Update the action_mapping_config.json file

You can update the suggested mappings in the action_mapping_config.json. After you update the file, you can rerun the identify_affected_policies.py script. This script generates updated suggestions for the affected policies.

You can make multiple versions of the action_mapping_config.json file to change the policies for different accounts with different permissions. For example, you might create one file named action_mapping_config_testing.json to migrate permissions for your test accounts and action_mapping_config_production.json for your production accounts.

Example 2: Update the affected_policies_and_suggestions.json file

To make changes to the suggested replacements for a specific affected policy group, you can directly edit the suggested replacements section within the affected_policies_and_suggestions.json file.

Any changes that you make in this section are applied to all policies within that specific affected policy group.

Example 3: Customize a specific policy

If you find that a policy within an affected policy group that needs different changes than the suggested updates, you can do the following:

Step 5: Update the affected policies

After you review and refine the suggested replacements, run the update_affected_policies.py script. The script takes the affected_policies_and_suggestions.json file as input. This script assumes the BillingConsolePolicyMigratorRole IAM role to update the affected policies listed in the affected_policies_and_suggestions.json file.

python3 update_affected_policies.py --affected-policies-directory Affected_Policies_<Timestamp>

The update_affected_policies.py script updates the affected policies within the affected_policies_and_suggestions.json file with the suggested new actions. The script adds a Sid block to the policies, identified as BillingConsolePolicyMigrator#, where # corresponds to an incremental counter (for example, 1, 2, 3).

For example, if there are multiple Sid blocks in the affected policy that use old actions, the script adds multiple Sid blocks that appear as BillingConsolePolicyMigrator# to correspond to each Sid block.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "ce:*",
                "aws-portal:ViewAccount"
            ],
            "Resource": "*",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:BillingRole"
            },
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        },
        {
            "Sid": "BillingConsolePolicyMigrator1",
            "Effect": "Allow",
            "Action": [
                "account:GetAccountInformation",
                "account:GetAlternateContact",
                "account:GetChallengeQuestions",
                "account:GetContactInformation",
                "billing:GetContractInformation",
                "billing:GetIAMAccessPreference",
                "billing:GetSellerOfRecord",
                "payments:ListPaymentPreferences"
            ],
            "Resource": "*",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:BillingRole"
            },
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        },
        {
            "Sid": "BillingConsolePolicyMigrator2",
            "Effect": "Deny",
            "Action": [
                "account:CloseAccount",
                "account:DeleteAlternateContact",
                "account:PutAlternateContact",
                "account:PutChallengeQuestions",
                "account:PutContactInformation",
                "billing:PutContractInformation",
                "billing:UpdateIAMAccessPreference",
                "payments:UpdatePaymentPreferences"
            ],
            "Resource": "*"
        }
    ]
} 

The script generates a status report that contains unsuccessful operations and outputs the JSON file locally.

[{
    "Account": "111111111111",
    "PolicyType": "Customer Managed Policy"
    "PolicyName": "AwsPortalViewPaymentMethods",
    "PolicyIdentifier": "identifier",
    "Status": "FAILURE", // FAILURE or SKIPPED	
    "ErrorMessage": "Error message details"
}]

Step 6: Revert your changes (Optional)

The rollback_affected_policies.py script reverts the changes applied to each affected policy for the specified accounts. The script removes all Sid blocks that the update_affected_policies.py script appended. These Sid blocks have the BillingConsolePolicyMigratorRole# format.

IAM policy examples

Policies are considered similar if they have identical:

The following examples show policies which IAM might or might not consider similar based on the differences between them.